Some questions about warden

[temp321]

It has been a while since I have reversed a game with anti-cheat, and I have been reading up on some of the warden info here to avoid getting detected. As far as I can tell, the warden only seems to do 2 things.

• Scan game functions for tampering.
• Scan pages in-process for known cheat hashes.

Am I missing something? It seems to do very little compared to what VAC does.

[Coding] VAC3 Dump (5-1-14)

• Scans deleted files from the NTFS journal and phones home contents if the filename matches some list.
• Scans your DNS cache for cheat domains.
• Scans the titles of all the windows you have open.
• Scans the filenames of all modules inside the process.
• Scans windows registry
• Also the 2 things mentioned above.

Is there any reason why warden doesn't do all this? I was half expecting everyone to be using custom ring0 drivers by now. Also why does it use RPM instead of inlined memcmp or something? Is it a separate process?

[namreeb]

It does do a few other things, but if you're asking whether VAC is more sophisticated, then yes, it is.

[temp321]

Can you elaborate on what else it does? And also why does Warden not do any of this? It doesn't seem that difficult to implement.

[dogzilla81]

Well, looking at the list of what VAC does, I'd say the reason is primarily that of privacy and the resulting shitstorm that could happen.

Scanning your DNS cache is outside the scope of what would be reasonable for software and might end up in a class action lawsuit against Blizzard.

I think they're probably more happy with catching whatever percentage of cheats they can without the risk of ending up in a privacy class action lawsuit with potentially millions of gamers.

[VesperCore]

Well, looking at the list of what VAC does, I'd say the reason is primarily that of privacy and the resulting shitstorm that could happen.

Scanning your DNS cache is outside the scope of what would be reasonable for software and might end up in a class action lawsuit against Blizzard.

I think they're probably more happy with catching whatever percentage of cheats they can without the risk of ending up in a privacy class action lawsuit with potentially millions of gamers.

Also because Blizzard only bans you if they have a proof of use, that's why many permban are revoked because GM did not gather enough data.

Fact is: Blizzard will never ban you for having a bot even if the executable was IN the wow folder, they want to catch you using it and only that.

[temp321]

Well, looking at the list of what VAC does, I'd say the reason is primarily that of privacy and the resulting shitstorm that could happen.

Scanning your DNS cache is outside the scope of what would be reasonable for software and might end up in a class action lawsuit against Blizzard.

I think they're probably more happy with catching whatever percentage of cheats they can without the risk of ending up in a privacy class action lawsuit with potentially millions of gamers.

But if this was true, then why does Valve not care? If Valve doesn't get sued, do you think the warden will add these features?

[Jadd]

I'm pretty sure the only reasonable explanation is that the Warden guy died.

But if this was true, then why does Valve not care? If Valve doesn't get sued, do you think the warden will add these features?

They were pushing it with the DNS cache hashing stunt. Frankly, they were lucky no one followed it up. They removed this detection method shortly after it was discovered.